Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Resource
win10v2004-20240802-en
General
-
Target
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
-
Size
61KB
-
MD5
8a6482ace82910ef617751edfa48fdd6
-
SHA1
fac0cfe15821914a9dd16ff9b50a633431ae1139
-
SHA256
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53
-
SHA512
bfe8bb01c013a518db39abbdb95ad9f62c042791356943741a6b6986e409e385808643fde2b0f0319a95ee0bc230e666a8ef9716fd222097701cb00999e20f1b
-
SSDEEP
768:W7BlphA7dASbSjJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiBhRKu:W7ZhA7dABJJ7TTQoQNKu
Malware Config
Signatures
-
Renames multiple (3736) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Mozilla Firefox\locale.ini.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Mozilla Firefox\updater.exe.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Journal\es-ES\jnwmon.dll.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe"C:\Users\Admin\AppData\Local\Temp\08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD58ba9b851fb9e0eb93860715fd38075de
SHA1db8aa8e7b182f608da256d0747819504be2201bc
SHA256d9c3db09a8f892e5b12d70f1ba712f3208863c51a9cd9d7b575b0bf5342034c5
SHA51246d71e462126371855741bafd96b36fc6d330b68158ff447b3f815b3c60d02a6afcee252821c703889901236119496013f4643329880784a84d0d395aaaa1949
-
Filesize
70KB
MD5101a2896e7c2e7226870acd5fb9951fc
SHA182d24aaa71a990be7a47f10725acfef0b29df226
SHA25609e94a11ccd75d2d51ba0328d597638475576e07b52bc739f0435c99a4a6d85c
SHA512347d8d9610083a32ef145373033f67357339b827d9c8c1c6ef36ef2f1891bd297a6d037859f16f5be1d5ba7dc91d7149cf4a1f29b53d3f2aa20fe37b5c8a529f